How fast is "without delay"?

The rule does not set a clock, which means the standard is as soon as you reasonably can once you believe an incident is reportable. Investigating to certainty first is not the intended reading.

Is this obligation already live?

Yes — since July 16, 2025. It does not wait for the 2027 plan deadline, and it is the obligation most operators do not realize they already carry.

Does calling the National Response Center handle everything?

It also satisfies FBI notification. It does not satisfy a separate Cybersecurity and Infrastructure Security Agency notification that certain entities owe. Determine which category you are in before you need to know.

Section 13 of 14§101.630(c)(13)

Incident reporting

Cyber incident reporting procedures

Who calls the National Response Center, when, and what they say.

This obligation has been in force since July 16, 2025 — it is not waiting for the 2027 deadline. Reportable cyber incidents go to the National Response Center without delay, at 1-800-424-8802, the same number every operator already knows from spill reporting.

Section 13 is where the procedure lives. The practical test is whether the person who answers the phone at two in the morning can execute it without reading the whole plan.

Also governed by§101.650(g)(1)§101.620(b)(7)§101.615

What the rule requires

What §101.630(c)(13) hard-wires into this section

The reporting duty: Reportable cyber incidents reported to the National Response Center without delay. "Without delay" is the standard — not within a set number of hours.
Who decides: Someone has to determine whether an event is reportable. The plan names that person and their alternate, and describes how they are reached.
What is reportable: The definition is deliberately broad, reaching operational disruption and data breach as well as anything that could become a transportation security incident. Where it is genuinely unclear, the reporting posture is the safer one.
The parallel notification: One call to the National Response Center also satisfies FBI notification, but not the Cybersecurity and Infrastructure Security Agency — certain entities must notify separately.
The record: The report number goes in the incident log, which lives under Section 4.

The standard

What a reviewer expects to see

A one-page card at the desk and in the wheelhouse — not a procedure buried at page forty
The four questions that decide reportability, phrased so a non-technical person can answer them
The National Response Center number printed, not linked
A statement of what the caller will be asked, so nobody is composing under pressure
The decision-maker and alternate with live phone numbers
An explicit instruction to report when unsure, and who to call first

An illustration

The wheelhouse card, which is the real deliverable

Not a template to copy. This is the shape and specificity a section reads with when it has been written from a real operation — bracketed where your facts go.

REPORTABLE CYBER INCIDENT — WHAT TO DO

Is any of this true?
  · A system we rely on is not working right, and it may not be an
    ordinary fault
  · Someone got into an account, a computer, or the network
  · Company or personal data may have been taken
  · Anything that could affect safe navigation or cargo transfer

If yes or unsure — call the CySO now: [number]
No answer in 10 minutes — call [alternate number]

The CySO reports to the National Response Center, 1-800-424-8802,
without delay, and writes the report number in the incident log.

Do not turn the machine off. Do not delete anything. Write down
the time and what you saw.

Evidence

What has to be producible

The incident log with report numbers and timestamps
The card or job aid itself, versioned
Records of any parallel notifications
Drill records showing the reporting decision was exercised

Records are kept at least two years and produced on demand §101.640, at the same vessel and facility inspections you already receive.

Failure modes

How this section gets a plan returned

A procedure nobody can find at 2 a.m.: This is the one section that must exist as a physical artifact somewhere a person will look under stress.
Assuming one call covers everything: The National Response Center call also reaches the FBI, but certain entities owe a separate notification to the Cybersecurity and Infrastructure Security Agency. Know which you are.
Waiting to be certain: The standard is without delay, and the definition is broad. Investigating first and reporting later inverts the duty.
No named decider: Where nobody owns the reportability call, the call does not get made — or it gets made by whoever is most anxious, at the wrong time.

Questions

What operators ask about this section

How fast is "without delay"?: The rule does not set a clock, which means the standard is as soon as you reasonably can once you believe an incident is reportable. Investigating to certainty first is not the intended reading.
Is this obligation already live?: Yes — since July 16, 2025. It does not wait for the 2027 plan deadline, and it is the obligation most operators do not realize they already carry.
Does calling the National Response Center handle everything?: It also satisfies FBI notification. It does not satisfy a separate Cybersecurity and Infrastructure Security Agency notification that certain entities owe. Determine which category you are in before you need to know.

Previous · Section 12

Unresolved vulnerabilities

Next · Section 14

The Cybersecurity Assessment